                             CHAPTER SIX

     This chapter will focus primarily on the standard Western 
Electric single-slot coin telephone (aka fortress fone) which can be 
divided into 3 types:
     - Dial-Tone First (DTF)
     - Coin-First (CF)
     - Dial Post-Pay Service (PP):  you pay after the party answers
     This chapter also deals with the plans for a Green Box, and 
gives a description of the infamous Red Box.


Depositing Coins (Slugs):
-------------------------
     Once you have deposited your slug into a fortress, it is 
subjected to a gamut of tests.
     The first obstacal for a slug is the magnetic trap.  This will 
stop any light-weight magnetic slugs and coins. If it passes this, 
the slug is then clied as a n, dime, or quarter.  Each slug is then 
checked for appropriate size and weight.  If these tests are passed, 
it will then travel through a nickel, dime, or quarter magnet as 
appropriate.  These magnets set up an eddy current effect which 
causes coins of the appropriate characteristics to slow down so they 
will follow the correct trajectory.  If all goes well, the coin will 
follow the correct path (such as bouncing off of the nickel anvil) 
where it will hopefully fall into the narrow accepted coin channel.
     The rather elaborate tests that are performed as the coin 
travels down the coin chute will stop most slugs and other 
undesirable coins, such as pennies, which must then be retrieved 
using the coin release lever.  If the slug miraculously survives the 
gamut, it will then strike the appropriate totalizer arm causing a 
ratchet wheel to rotate once for every 5-cent increment (eg, a 
quarter will cause it to rotate 5 times).
     The totalizer then causes the coin signal oscillator to readout 
a dual-frequency signal indicating the value deposited to ACTS (a 
computer) or the TSPS operator. These are the same tones used by 
phreaks in the infamous red boxes.  For a quarter, 5 beep tones are 
outpulsed at 12-17 pulses per second (PPS).  A dime causes 2 beep 
tones at 5 - 8.5 PPS while a nickel causes one beep tone at 5 - 8.5 
PPS.  A beep consists of 2 tones:  2200 + 1700 Hz.
     A relay in the fortress called the "B relay" (yes, there is also 
an 'A relay') places a capacitor across the speech circuit during 
totalizer read-out to prevent the "customer" from hearing the red box 
tones.  In older 3 slot phones:  one bell (1050 -1100 Hz) for a 
nickel, two bells for a dime, and one gong (800 Hz) for a quarter are 
used instead of the modern dual-frequency tones.

                             TSPS & ACTS
                             -----------

     While fortresses are connected to the CO of the area, all 
transactions are handled via the Traffic Service Position System 
(TSPS).  In areas that do not have ACTS, all calls that require 
operator assistance, such as calling card and collect, are 
automatically routed to a TSPS operator position.
     In an effort to automate fortress service, a computer system 
known as Automated Coin Toll Service (ACTS) has been implemented in 
many areas.  ACTS listens to the red box signals from the fones and 
takes appropriate action.  It is ACTS which says, "Two dollars please 
(pause) Please deposit two dollars for the next ten seconds" (and 
other variations). Also, if you talk for more than three minutes and 
then hang-up, ACTS will call back and demand your money.  ACTS is 
also responsible for Automated Calling Card Service.
     ACTS also provide trouble diagnosis for craftspeople (repairmen 
specializing in fortresses).  For example, there is a coin test which 
is great for tuning up red boxes.  In many areas this test can be 
activated by dialing 09591230 at a fortress.  Once activated it will 
request that you deposit various coins. It will then identify the 
coin and outpulse the appropriate red box signal.  The coins are 
usually returned when you hang up.
     To make sure that there is actually money in the fone, the CO 
initiates a "ground test" at various times to determine if a coin is 
actually in the fone.  This is why you must deposit at least a nickel 
in order to use a red box!

Green Boxes:
------------
     Paying the initial rate in order to use a red box (on certain 
fortresses) left a sour taste in many red boxer's mouths thus the 
GREEN BOX was invented.  The green box generates useful tones such as 
COIN COLLECT, COIN RETURN, and RINGBACK.  These are the tones that 
ACTS or the TSPS operator would send to the CO when appropriate. 
Unfortunately, the green box cannot be used at a fortress station but 
it must be used by the CALLED party.  Here are the tones:

     COIN COLLECT	700 + 1100 Hz
     COIN RETURN       1100 + 1700 Hz
     RINGBACK		700 + 1700 Hz

     Before the called party sends any of these tones, an operator 
released signal should be sent to alert the MF detectors at the CO.  
This can be accomplished by sending 900 + 1500 Hz or a single 2600 Hz 
wink (90 ms) followed by a 60 ms gap and then the appropriate signal 
for at least 900 ms.  Also, do not forget that the initial rate is 
collected shortly before the 3 minute period is up.
     Incidentally, once the above MF tones for collecting and 
returning coins reach the CO, they are converted into an appropriate 
DC pulse (-130 volts for return & +130 volts for collect). This pulse 
is then sent down the tip to the fortress.  This causes the coin 
relay to either return or collect the coins.
     The alleged "T-Network" takes advantage of this information.  
When a pulse for COIN COLLECT (+130 VDC) is sent down the line, it 
must be grounded somewhere.  This is usually either the yellow or 
black wire.  Thus, if the wires are exposed, these wires can be cut 
to prevent the pulse from being grounded.  When the three minute 
initial period is almost up, make sure that the black & yellow wires 
are severed; then hang up, wait about 15 seconds in case of a second 
pulse, reconnect the wires, pick up the fone, hang up again, and if 
all goes well it should be "JACKPOT" time.

Physical Attack:
----------------
     A typical fortress weighs roughly 50 lbs. with an empty coin 
box.  Most of this is accounted for in the armor plating.  Why all 
the security?  Well, Bell contributes it to the following:
     "Social changes during the 1960's made the multislot coin 
station a prime target for:  vandalism, strong arm robbery, fraud, 
and theft of service.  This brought about the introduction of the 
more rugged single slot coin station and a new environment for coin 
service."  As for physical attack, the coin plate is secured on all 
four side by hardened steel bolts which pass through two slots each.	
These bolts are in turn interlocked by the main lock.
     One phreak I know did manage to take one of the 'mothers' home 
(which was attached to a piece of plywood at a construction site; 
otherwise, the permanent ones are a bitch to detach from the wall!).  
It took him almost ten hours to open the coin box using a power 
drill, sledge hammers, and crow bars (which was empty -- perhaps next 
time, he will deposit a coin first to hear if it slushes down nicely 
or hits the empty bottom with a clunk.)
     Taking the fone offers a higher margin of success.  Although 
this may be difficult often requiring brute force and there has been 
several cases of back axles being lost trying to take down a fone!  A 
quick and dirty way to open the coin box is by using a shotgun.  In 
Detroit, after ecologists cleaned out a municipal pond, they found 
168 coin phone rifled.  In colder areas, such as Canada, some shrewd 
people tape up the fones using duct tape, pour in water, and come 
back the next day when the water will have froze thus expanding and 
cracking the fone open.  In one case, "unauthorized coin collectors" 
where caught when they brought $6,000 in change to a bank and the 
bank became suspicious...
     At any rate, the main lock is an eight level tumbler located on 
the right side of the coin box.  This lock has 390,625 possible 
positions (5 ^ 8, since there are 8 tumblers each with 5 possible 
positions) thus it is highly pick resistant!  The lock is held in 
place by 4 screws.  With clearance to the right of the fone, you can 
punch out the screws using the drilling pattern below:

 ====================================
		     ||        ^
	 | 1- 3/16 " ||        |
	 |<---	 --->||      1-1/2"
     +---+-----------++-+      |
     |	 |           || |      |
     |	(+)         (+)-+-----------
  +--+	             || |      ^
  |  |        (Z)    || |      |
  |  |	             || |   2-3/16"
  +--+	             || |      |
     |	(+)         (+) |      |
     |               || |      |
     +---------------++-+------+----
                     ||
      (Z) Keyhole   (+) Screws
                     ||
  ===================================

     After this is accomplished, the lock can be pushed backwards 
disengaging the lock from the cover plate.  The four bolts of the 
cover plate can then be retracted by turning the boltworks with a 
simple key in the shape of the hole on the coin plate (see diagram 
below).	Of course, there are other methods and drilling patterns.

:-------------------------------------:
		   _
		  | |
		  ( )
		  |_|
	       [roughly]
    Diagram of cover plate keyhole
:-------------------------------------:

     The top cover uses a similar (but not as strong) locking method 
with the keyhole depicted above on the top left side and a regular 
lock (probably tumbler also) on the top right-hand side. It is 
interesting to experiment with the coin shute and the fortresses own 
"red box" (which Bell didn't have the 'balls' to color red).

Miscellaneous:
--------------
     In a few areas (rural & Canada), post- pay service exists.  With 
this type of service, the mouthpiece is cut off until the caller 
deposits money when the called party answers.  This also allows for 
free calls to weather and other DIAL-IT services!  Recently, 2600 
magazine announced the CLEAR BOX which consists of a telephone pickup 
coil and a small amp.  It is based on the principal that the receiver 
is also a weak transmitter and that by amplifying your signal you can 
talk via the transmitter thus avoiding costly telephone charges!
     Most fortresses are found in the 9xxx area.  Under former Bell 
areas, they usually start at 98xx (right below the 99xx official 
series) and move downward.
     Since the line, not the fone, determines whether or not a 
deposit must be made, DTF & Charge-A-Call fones make great 
extensions!
     Finally, fortress fones allow for a new hobby--instruction plate 
collecting.  All that is required is a flat-head screwdriver and a 
pair of needle-nose pliers.  Simply use the screwdriver to lift 
underneath the plate so that you can grab it with the pliers and yank 
downwards. I would suggest covering the tips of the pliers with 
electrical tape to prevent scratching.	Ten cent plates are 
definitely becoming a "rarity!"

Fortress Security:
------------------
     While a lonely fortress may seem the perfect target, beware!  
The Gestapo has been known to stake out fortresses for as long as 6 
years according to the Grass Roots Quarterly.	To avoid any 
problems, do not use the same fones repeatedly for boxing, calling 
cards, & other experiments.  The telco knows how much money should be 
in the coin box and when its not there they tend to get perturbed 
(read:  pissed off).

